KaraZajac
70972e0c9d
build / build (clang / debug) (push) Waiting to run
build / build (clang / default) (push) Waiting to run
build / build (gcc / debug) (push) Waiting to run
build / build (gcc / default) (push) Waiting to run
build / sanitizers (ASan + UBSan) (push) Waiting to run
build / clang-tidy (push) Waiting to run
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
build / static-build (push) Waiting to run
The module built the right EDITOR="helper -- /etc/passwd" injection but failed
two ways, both now fixed (VM-verified root on Ubuntu 22.04.0 / sudo
1.9.9-1ubuntu2):
1. Writable-CWD guard: sudoedit refuses to edit any file whose parent dir is
user-writable. The injected "--" is resolved relative to CWD, so running
from home/tmp made sudoedit abort "--: editing files in a writable
directory" before the editor ran. Fix: chdir("/") in the sudoedit child.
2. Wrong tmp copy: sudoedit hands the editor one tmp copy per file, named
<basename>.XXXXXX. The helper wrote argv[argc-1] — the sudoers-authorized
COVER file (e.g. motd), not the target. Fix: the helper now matches the
target's basename prefix (passed via SKEL_TARGET) to pick the right copy.
Result: /etc/passwd gains a skel::0:0 row; `su skel` -> uid=0(root).
docs/EXPLOITED.md + VERIFICATIONS.jsonl updated. Unit harness green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y